CVE-2017-13007: The Apple PKTAP parser in tcpdump before 4.9.2 has a buffer over-read in print-pktap.c:pktap_if_print().

Security readout for executives and security teams

CVE-2017-13007 is a tcpdump flaw in the Apple PKTAP packet parser. A crafted packet capture could make vulnerable tcpdump versions read beyond an expected buffer while decoding data. The public bundle does not provide CVSS, confirmed impact, or active exploitation evidence. Exposure is most likely where vulnerable tcpdump versions process untrusted packet captures or PKTAP-formatted traffic data. Systems merely having tcpdump installed may be lower risk unless users, automation, or support workflows analyze attacker-supplied captures. Prioritize routine remediation where tcpdump is used for incident response, network troubleshooting, or automated capture analysis. Urgency increases if staff process untrusted captures. Current evidence does not support emergency treatment based on active exploitation. Mitigation focus: Upgrade tcpdump to 4.9.2 or a vendor package containing the fix.; Apply relevant OS vendor security updates from Debian, Gentoo, Red Hat, or Apple guidance.; Restrict analysis of untrusted packet captures to patched systems or isolated tooling..

Prepared

Jun 12, 2026, 20:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.